Federal: AFC Response to OCC Violations of Laws or Regulations Rulemaking

October 1, 2026

The Honorable Jonathan V. Gould
Comptroller of the Currency
Office of the Comptroller of the Currency
Attn: Comment Processing, Chief Counsel’s Office
400 7th St., SW
Washington, DC 20219

Re: Response to Notice of Proposed Rulemaking on Violations of Laws or Regulations

Dear Comptroller Gould,

On behalf of the American Fintech Council (AFC),  I submit this comment letter in response to the Office of the Comptroller of the Currency’s (OCC) Notice of Proposed Rulemaking regarding Violations of Laws or Regulations (Proposed Rule).  AFC appreciates the OCC’s continued effort to refine its supervisory framework so that matters requiring attention (MRAs) are reserved for legal violations that warrant heightened supervisory attention, while less significant violations are addressed through a proportionate and administrable process.

AFC is a standards-based organization and the largest and most diverse trade association representing financial technology companies and innovative banks. On behalf of more than 150 member companies and partners, AFC promotes a transparent, inclusive, and customer-centric financial system by supporting responsible innovation in financial services and encouraging sound public policy. AFC’s membership includes institutions and technology providers that operate across banking, lending, payments, compliance, data, and other regulated financial services, providing AFC with a broad perspective on how supervisory standards affect institutional governance, compliance programs, operational decision making, and the ability to devote resources to the risks that matter most.

The Proposed Rule presents an important opportunity to place durable boundaries around the use of MRAs for violations of law. The practical consequence of an MRA extends well beyond the identification of a compliance issue. MRAs are costly and time-consuming endeavors for financial institutions. Specifically, they require significant senior management attention, board visibility, remediation planning, testing, validation, and sustained examiner follow-up. Those activities are appropriate when a violation is sufficiently consequential to justify that degree of supervisory intervention. However, they are less appropriate when the issue is isolated, readily correctable, and unlikely to produce meaningful harm. A framework that differentiates those circumstances with precision can improve compliance outcomes while allowing both examiners and institutions to concentrate attention on the most consequential legal and financial risks.

AFC therefore supports the OCC’s basic distinction between substantive and technical violations, but recommends several refinements to make that distinction more objective, more consistently administered, and less susceptible to escalation through supervisory discretion. In particular, the final rule should anchor substantive violations to demonstrable materiality, preserve the banking or banking-related limitation, establish clear safeguards for technical violations, and pair the new classification framework with transparent, reviewable supervisory determinations. These refinements would further the same risk-based supervisory objectives reflected in the OCC’s recent MRA rulemaking and supervisory policy revisions.

I. AFC Supports a Clear and Objective Substantive Violation Standard that Directs MRAs Toward Meaningful Legal and Financial Risk

As a threshold matter, the five substantive violation categories should operate as genuine limiting principles rather than illustrative pathways through which virtually any legal violation may be elevated into an MRA. The central inquiry should remain whether the violation, viewed in context, has produced or can reasonably be expected to produce a meaningful consequence for the institution, its customers, or the integrity of its financial records. Mere involvement of an important statute, occurrence within a regulated activity, or characterization as something more than a clerical error should not, standing alone, render a violation substantive. Instead, classification should turn on the significance of the underlying violation and the consequences reasonably attributable to it.

Providing greater precision around the meaning of “more than minimal” is equally important to maintaining this distinction. Considering that this phrase appears throughout several of the proposed categories, its practical application will largely determine where the line between substantive and technical violations is drawn.  The final rule should direct examiners to assess the magnitude, duration, frequency, customer effect, financial consequence, and likelihood of recurrence in combination, while making clear that a marginal or theoretical possibility of harm is insufficient. Where actual harm has not materialized, any anticipated impact should rest upon a direct and factually grounded causal connection rather than a succession of speculative assumptions. Such an approach would preserve appropriate examiner judgment while supplying sufficient structure to promote consistent application across institutions and examination teams.

Comparable rigor should govern determinations that violations are “systemic” or constitute a “pattern.” Recurrence, without more, should not automatically transform otherwise technical violations into a substantive violation. Rather, a pattern finding should be supported by evidence that repeated violations reflect a common control weakness, sustained noncompliance, or another recurring deficiency that creates a meaningful risk of harm. Isolated errors arising from unrelated causes, particularly where promptly identified and corrected, should not be aggregated merely to satisfy a numerical threshold. Nor should the OCC rely upon a purely percentage-based test. A more faithful assessment would consider the volume of relevant activity, number of affected transactions or customers, duration of the conduct, source of the errors, effectiveness of the institution’s detection and remediation efforts, and whether the circumstances reasonably indicate a continuing compliance deficiency.

A similarly “consequence-focused” approach is warranted when assessing violations involving customers. Technical noncompliance should remain distinguishable from conduct that meaningfully impairs a customer’s rights or economic interests. For example, a technical disclosure defect, formatting omission, or isolated timing error should not support an MRA absent a more than minimal financial or nonfinancial effect. Conduct that materially affects a customer’s ability to understand a transaction, exercise a legal right, avoid an improper charge, or obtain required restitution presents a materially different supervisory concern and may appropriately warrant substantive treatment. Anchoring the inquiry in practical customer consequences, rather than the mere existence of a technical defect, would help ensure that minor compliance imperfections do not receive the same supervisory treatment as conduct producing genuine consumer harm.

Finally, preserving the phrase “banking or banking-related” within the MRA standard would maintain an appropriate nexus between the supervisory tool and the OCC’s prudential responsibilities. Although the agency’s supervisory authority necessarily encompasses a broad range of legal obligations, an MRA is fundamentally a prudential supervisory instrument and should remain connected to an institution’s banking activities, financial condition, customers, books and records, or safe and sound operation. Eliminating that limitation could permit the MRA framework to extend into matters only tangentially related to the OCC’s core supervisory mission. Where another legal regime already provides an independent enforcement or remedial mechanism, a violation should not, absent an additional banking nexus, become a separate basis for issuance of an MRA.

II. AFC Recommends that the OCC Limit Technical Violations to Correction of the Underlying Legal Deficiency and Prohibit MRA-Equivalent Remediation Requirements

To preserve a meaningful distinction between substantive and technical violations, AFC recommends that the final rule expressly limit the supervisory response to a technical violation to correction of the underlying legal deficiency and prohibit examiners from imposing remediation requirements that replicate the practical consequences of an MRA. A technical violation should operate as a genuine alternative to the MRA process for matters that do not satisfy the substantive standard, with the supervisory consequences reflecting that distinction. A technical violation should require correction of the underlying legal deficiency while preserving the institution’s discretion to determine the appropriate method of remediation, unless a particular corrective measure is independently required by law. Consistent with that principle, the final rule should expressly provide that examiners may not rely on informal requests, examination conditions, or related supervisory observations to recreate the action plans, milestones, validation requirements, or board reporting obligations that ordinarily accompany an MRA.

Equally important, resolution of a technical violation should occur once the underlying legal deficiency has been corrected, subject only to any recordkeeping, restitution, or other obligation independently imposed by applicable law. Formal remediation plans, target dates, recurring status reports, independent validation, and proof of closure should not become default conditions for resolving matters that the OCC has determined do not warrant substantive treatment. Institutions may appropriately retain documentation sufficient to demonstrate correction through their ordinary compliance processes, but such documentation should not serve as a vehicle for imposing an MRA-equivalent supervisory regime on a finding that has been classified as technical.

A clear anti-bootstrapping principle would further reinforce the integrity of this framework. One or more technical violations should not support an MRA merely because similar matters were cited previously. Escalation should occur only where newly developed facts independently satisfy the substantive violation standard, such as evidence of a common root cause, sustained recurrence, meaningful customer harm, or another enumerated substantive criterion. Without such a safeguard, technical findings could accumulate mechanically into an MRA even though no individual development independently establishes substantive risk. That result would erode the distinction the Proposed Rule seeks to create and reintroduce uncertainty through the later stages of the supervisory process.

At the same time, a concise written record of each technical violation would promote consistency without burdening institutions with additional remediation requirements. Such documentation should identify the applicable legal requirement, the relevant facts, and the basis for classifying the matter as technical rather than substantive. Maintaining that record would help preserve institutional understanding across examination cycles and reduce the risk that a later examination team revisits the same issue under a materially different standard absent changed facts. In practical terms, the framework should remain intentionally straightforward: identify the legal deficiency, require correction, document the disposition, and avoid unnecessary supervisory process once the matter has been addressed.

More broadly, this calibrated approach would enable the OCC to continue directing supervisory attention toward material financial risks rather than process, documentation, and other nonfinancial concerns. A properly implemented technical violation framework can give practical effect to that principle by calibrating supervisory intensity to the significance of the underlying legal issue rather than to the mere existence of a violation.

III. AFC Recommends that the OCC Apply Risk-Based Tailoring to the Assessment of a Violation Without Altering the Substantive Violation Threshold

The final rule should make clear that risk-based tailoring will keenly inform the OCC’s assessment of the significance of a violation within the context of a particular institution without altering the legal threshold that separates substantive from technical violations. The same substantive categories should govern across the OCC’s supervised institutions, while institution-specific considerations such as asset size, business model, transaction volume, organizational complexity, product mix, and customer exposure inform the materiality analysis within those categories. This distinction is important. Tailoring should provide context for determining the significance of a particular conduct and not establish different substantive standards depending upon the institution under examination.

That principle is particularly important when determining whether repeated violations constitute a pattern. Rather than relying on any single numerical measure, the OCC should consider absolute incidence and error rate alongside the institution’s overall level of relevant activity. A small number of errors may carry greater significance in a low-volume activity, while the same number may be comparatively limited within a substantially larger business line. Conversely, a relatively low error rate may still warrant heightened supervisory attention for an institution in which the error is substantial and the resulting harm is meaningful. Accordingly, examiners should articulate how the relevant facts, considered proportionately and in combination, demonstrate sustained noncompliance or meaningful risk. Such an explanation becomes especially important where an MRA rests upon the aggregation of individual violations that, viewed independently, would otherwise be technical.

Similar discipline should guide the assessment of violations affecting an institution’s financial condition or the accuracy of its books and records. Wherever practicable, the OCC should rely on established concepts of materiality rather than develop a parallel supervisory standard whose application may be difficult for institutions to anticipate. Financial impact should be evaluated relative to the institution or affected business line and should result from the violation itself, rather than from a hypothetical enforcement consequence arising after the fact. Likewise, an inaccuracy in books and records should warrant substantive treatment where it could meaningfully distort management, regulatory, or public understanding of the institution’s financial condition. An immaterial error that does not affect those purposes and can be readily corrected through ordinary reporting processes should not receive equivalent supervisory treatment.

With respect to state law, additional clarity is warranted to ensure that tailoring does not obscure threshold questions of applicability and supervisory authority. A state-law violation should support an MRA only where the relevant requirement applies to the national or federal bank, the OCC possesses a legitimate supervisory basis for addressing compliance with that requirement, and the conduct independently satisfies at least one substantive criterion. The mere existence of a state-law obligation should not lower the substantive threshold or permit the MRA process to resolve unsettled questions of preemption, applicability, or enforcement authority. Where such a legal predicate remains genuinely disputed, that predicate should be resolved before an MRA is used to compel compliance with the contested interpretation.

Finally, maintaining clear boundaries among separate supervisory mechanisms would further promote a proportionate and administrable framework. The OCC should preserve the proposal’s exclusion for noncompliance with guidelines already governed by distinct supervisory processes, including the safety and soundness standards contained in 12 CFR part 30. More broadly, where a guideline or supervisory framework establishes its own graduated mechanism for addressing deficiencies, the OCC should avoid layering the substantive and technical violation framework onto that process unless the underlying conduct independently violates a law or regulation. Maintaining this separation would reduce duplicative supervisory treatment while preserving the distinct roles of binding legal requirements, enforceable guidelines, and nonbinding supervisory expectations.

IV. AFC Recommends That the OCC Require Written Support for Substantive Violation Classifications and Preserve Meaningful Supervisory Review

The final rule should require the OCC to provide a written explanation for each substantive violation supporting an MRA, enabling institutions to understand the basis for the classification and meaningfully assess whether the substantive threshold has been satisfied. That explanation should identify the applicable legal requirement, the material facts, the specific substantive category upon which the OCC relies, and the basis for concluding that the relevant threshold has been met. Generalized assertions that conduct is “systemic,” produces a “more than minimal” impact, or is “reasonably expected” to result in adverse consequences should not, standing alone, establish a substantive violation. Rather, the supervisory record should articulate the factual connection between the cited conduct and the governing substantive criterion.

Complementing that requirement with robust internal quality-control procedures would further promote consistent application across examination teams. Before issuing an MRA solely on the basis of a legal violation, the responsible supervisory office should confirm that the factual record satisfies at least one substantive category and that the required corrective action bears a direct and proportionate relationship to the cited violation. Periodic examiner training, together with anonymized examples illustrating circumstances that fall above and below the substantive threshold, could provide additional consistency without unduly constraining supervisory judgment. The objective should be to channel that judgment through common and identifiable standards so that similarly situated institutions can reasonably anticipate comparable supervisory treatment.

Meaningful access to supervisory review is equally important where an institution disputes either the existence of the underlying legal violation or its classification as substantive. Meaningful access to an independent and efficient supervisory review process is equally important where an institution disputes either the existence of the underlying legal violation or its classification as substantive. Consistent with those principles, the final rule should expressly confirm that an institution may challenge the substantive classification of a violation without that challenge being characterized as resistance to supervision or a failure to remediate. Where an institution promptly corrects the underlying conduct while preserving a legal or supervisory objection, the act of remediation should not itself be construed as an admission that the violation satisfied the substantive standard.

That same principle of procedural clarity should extend to the correction of technical violations. Examiner disagreement with an institution’s chosen remediation method should not, by itself, provide a basis for elevating a technical violation into a substantive one. Where applicable law does not prescribe a particular method of correction, institutions should retain reasonable discretion to select an effective and appropriately tailored remedial approach. Supervisory review should accordingly focus on whether the legal deficiency has been corrected and whether newly developed facts independently satisfy a substantive criterion, rather than on whether management adopted the examiner’s preferred process.

Taken together, these safeguards would reinforce the substantive limitations established elsewhere in the Proposed Rule. Written reasoning, consistent internal review, meaningful avenues for challenge, and appropriate institutional discretion in remediation would help ensure that the substantive and technical violation framework operates according to stable supervisory principles rather than standards whose practical meaning varies from one examination team or supervisory cycle to another.

* * *

AFC appreciates the OCC’s continued work to establish a more transparent, risk-based, and proportionate supervisory framework. A carefully defined distinction between substantive and technical violations can strengthen compliance by directing heightened supervisory attention to violations that meaningfully affect institutions, while ensuring that minor and readily correctable deficiencies are addressed without unnecessary process or escalation.

AFC welcomes continued dialogue with the OCC and would be pleased to provide any additional information that may assist the agency as it finalizes and implements the rule.

Sincerely,

Ian P. Moloney
Chief Policy Officer
American Fintech Council

[1] American Fintech Council’s (AFC) membership spans banks, non-bank lenders, payments providers, EWA providers, loan servicers, credit bureaus, and personal financial management companies.
[2] Office of the Comptroller of the Currency, “Violations of Laws or Regulations,” Federal Register 91, no. 168 (September 1, 2026): 56074–56080.
[3] Office of the Comptroller of the Currency, “Violations of Laws or Regulations,” Federal Register 91, no. 168 (September 1, 2026): 56075–56078.

‍